You can prevent the use of remote URL avatars by disabling it in the ACP. I'd like to see such an option for the personal photo, too.

While thinking about that I also thought about the possibility to prevent users from using too large images in signatures. Remote URL images cannot be controlled well, so there may be an option for users to upload a signature image just like they can upload an avatar image or a personal photo. Then you could specify which dimensions such images may have.

Yeah. But these seem kind of like givens.

...possibility to prevent users from using too large images in signatures.

I agree.